Security Flaws Exposed in Anthropic’s Claude Code AI Development Tool

Generative AI is rapidly entering software development workflows, but it also exposes companies to risks from model errors, sensitive-data leaks and the amplification of insecure code. AI model developer Anthropic used Claude to demonstrate how threat modeling and vulnerability remediation can be incorporated into the development lifecycle, helping security and engineering teams establish human review, testing and remediation processes.

Cybersecurity information released on June 18 showed that Anthropic had published a security best-practices guide and an open-source reference implementation explaining how Claude can be used to build threat models, review source code for vulnerabilities and recommend fixes. The materials disclosed no financial amounts. The National Communications Commission also issued guidelines for the use of AI in news production and broadcasting, requiring AI use to be disclosed throughout the process and content to undergo human verification.

N-day vulnerabilities are publicly disclosed flaws for which patches are available but some devices remain unpatched. Attackers can compare code before and after a patch to reverse-engineer the weakness. Anthropic said weaponization previously often took weeks, giving companies time to roll out updates in stages. If AI compresses that timeline to hours, medical devices, industrial control systems and systems that are difficult to restart would be hit first.

Anthropic released test results on June 8, 2026, showing that Claude Mythos Preview autonomously developed eight code-execution exploits targeting 18 patched Firefox vulnerabilities. It produced the first in under one hour and completed all eight in about 12 hours. It also generated eight complete privilege-escalation exploit chains from 21 Windows kernel vulnerabilities at a cost of $15,700, highlighting the risk of “N-hour” attacks.

Anthropic’s Claude Code is a development environment that uses generative AI to help developers read and write code and operate tools. Prompt injection can override a user’s intent if the system mistakes text in a GitHub repository for trusted instructions. Microsoft said the flaw posed a significant risk because CI/CD systems often hold highly privileged credentials such as deployment keys and cloud tokens.

Microsoft security researchers recently disclosed that attackers could hide malicious prompts in GitHub content, inducing Claude Code to execute unintended commands and send CI/CD credentials to an external destination. Anthropic has patched the flaw. Users of version 2.1.128 and earlier are advised to upgrade immediately to reduce the risk of compromise to software supply chains and deployment environments.

Claude Code GitHub Actions allows AI agents to respond to instructions and modify code within software-development workflows. If trigger identities and permissions are not rigorously checked, attackers could use malicious content to induce an agent to access sensitive information such as GitHub tokens. That could compromise code repositories and automated deployment environments, making the patch important for software supply-chain security.

Anthropic patched a permission bypass in Claude Code v1.0.94 caused by insufficient checks on GitHub App triggers. It also strengthened configuration controls and safeguards to reduce the risk of token leaks. Available information did not disclose the exact dates of the vulnerability advisory or patch, the number of affected organizations, any financial losses or known cases of exploitation.

Anthropic’s Claude Chrome extension can operate webpages on a user’s behalf, giving it access to tab content and sensitive data. Cybersecurity firm LayerX named the design flaw ClaudeBleed, warning that malicious extensions requiring no special permissions could cross trust boundaries and hijack the AI agent. The flaw highlights the security risks created as browser-based AI tools gain broader privileges.

As of July 20, 2026, Anthropic had released a patched version, but LayerX testing found that version 1.0.70 still did not eliminate the underlying design issue. Attackers could potentially continue using malicious Chrome extensions to control Claude and exfiltrate data. No information has been disclosed about the number of victims, financial losses or the patch’s release date, and users should continue limiting extension permissions and checking installation sources.

Anthropic’s Claude Code is an AI development agent that can read and write code and connect to external tools, while the Model Context Protocol (MCP) links it to data and services. If OAuth tokens are exposed, attackers can assume a developer’s privileges, bypass passwords and multi-factor authentication, and tamper with GitHub repositories. This could turn a compromise of a single device into a software supply-chain attack.

Cybersecurity firm Mitiga disclosed on May 8, 2026, that Claude Code stores MCP configurations and OAuth tokens in plaintext in ~/.claude.json. A malicious NPM package could use a postinstall script to rewrite server addresses and trust flags, redirecting traffic through an attacker-controlled proxy to steal reusable, automatically refreshed tokens. Anthropic said the attack would first require local code-execution access and did not include the issue in its remediation work.

Traditional static analysis relies heavily on existing rules, making it prone to missing contextual vulnerabilities involving business logic or access controls. Anthropic is using Claude to understand entire codebases in an effort to embed security reviews into development workflows. If companies cut spending on existing tools, the valuations of platform providers such as CrowdStrike and Palo Alto Networks, as well as financial institutions' procurement decisions, could be affected.

Anthropic launched a limited research preview of Claude Code Security for enterprise customers on February 20, 2026. Pricing was not disclosed, while open-source maintainers can apply for free access. Claude Opus 4.6 has identified more than 500 vulnerabilities. On February 23, CrowdStrike, Datadog and Zscaler fell about 11%, Fortinet and Okta dropped about 6%, and Palo Alto Networks declined 3%.

The cybersecurity industry has long relied on rules-based static analysis and manual reviews. Static tools struggle to detect contextual vulnerabilities involving business logic and access controls, while manual reviews are constrained by the supply of skilled professionals. Anthropic’s use of large language models to find vulnerabilities and draft patches could shift defenses from post-incident detection to the development stage. It is also prompting investors to reassess the pricing power and competitive barriers of traditional cybersecurity software.

Anthropic released a research preview of Claude Code Security on February 20, 2026. The tool can scan for vulnerabilities and propose patches that require human approval. On February 23, CrowdStrike, Datadog and Zscaler fell about 11%, while Fortinet and Okta dropped about 6%. CrowdStrike had lost 18% since the product’s release, wiping about $20 billion from its market value.

Traditional static analysis relies heavily on established rules and can miss flaws involving data flows across components, business logic and access controls. Security teams also struggle to process large vulnerability backlogs. Anthropic has therefore integrated Claude’s code-reasoning capabilities into defensive workflows, enabling AI to scan and validate code and propose patches, though developers must still approve any fixes.

Anthropic launched the Claude Code Security research preview on February 20, 2026. Powered by Claude Opus 4.6, it scans and validates code and proposes patches, and has identified more than 500 vulnerabilities in open-source projects. The company released a six-stage reference workflow on May 27. As of May 22, it had disclosed 1,596 vulnerabilities, 97 of which had been fixed.